Update OpenAPI spec (2026-03-25) (#3)

Co-authored-by: workos-sdk-automation[bot] <255426317+workos-sdk-automation[bot]@users.noreply.github.com>

Author: workos-sdk-automation[bot]

.last-synced-sha

@@ -1 +1 @@
-de458a3b6d5e3e7c8c02eef4117639c81be1a720
+dfd1301aa2bd693e30269829ff052b93ec0862c4

spec/open-api-spec.yaml

@@ -8772,15 +8772,6 @@ paths:
       description: Initiates the single sign-on flow.
       security: []
       parameters:
-        - name: code_challenge_method
-          required: false
-          in: query
-          description: >-
-            The only valid PKCE code challenge method is `"S256"`. Required when
-            specifying a `code_challenge`.
-          schema:
-            type: string
-            example: S256
         - name: provider_scopes
           required: false
           in: query
@@ -8941,15 +8932,6 @@ paths:
           description: >-
             A random string generated by the client that is used to mitigate
             replay attacks.
-        - name: code_challenge
-          required: false
-          in: query
-          description: >-
-            Code challenge derived from the code verifier used for the PKCE
-            flow.
-          schema:
-            type: string
-            example: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
       responses:
         '200':
           description: OK
@@ -9763,6 +9745,34 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_pending_authentication_token
+                        const: invalid_pending_authentication_token
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: user_mismatch
+                        const: user_mismatch
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
                   - type: object
                     properties:
                       error:
@@ -9911,6 +9921,20 @@ paths:
                     required:
                       - error
                       - error_description
+                  - type: object
+                    properties:
+                      error:
+                        type: string
+                        description: The OAuth error code.
+                        example: extra_attributes_required
+                        const: extra_attributes_required
+                      error_description:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: 'The request failed due to: extra_attributes_required.'
+                    required:
+                      - error
+                      - error_description
                   - type: object
                     properties:
                       error:
@@ -10199,6 +10223,62 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: passkey_progressive_enrollment
+                        const: passkey_progressive_enrollment
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: radar_challenge
+                        const: radar_challenge
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: radar_sign_up_challenge
+                        const: radar_sign_up_challenge
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: application_consent_required
+                        const: application_consent_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
         '404':
           description: Not Found
           content:
@@ -14642,6 +14722,125 @@ paths:
       tags:
         - webhooks
   /webhook_endpoints/{id}:
+    patch:
+      operationId: WebhookEndpointsController_update
+      summary: Update a Webhook Endpoint
+      description: Update the properties of an existing webhook endpoint.
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: Unique identifier of the Webhook Endpoint.
+          schema:
+            type: string
+            example: we_0123456789
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateWebhookEndpointDto'
+      responses:
+        '200':
+          description: Webhook endpoint updated successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WebhookEndpointJson'
+        '404':
+          description: Webhook endpoint not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: entity_not_found
+                    const: entity_not_found
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '409':
+          description: A Webhook Endpoint with the same endpoint URL already exists.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: duplicate_endpoint
+                    const: duplicate_endpoint
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_url
+                        const: invalid_url
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                      errors:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            code:
+                              type: string
+                              description: The validation error code.
+                              example: unknown_event_type
+                            message:
+                              type: string
+                              description: >-
+                                A human-readable description of the validation
+                                error.
+                              example: Invalid enum value.
+                          required:
+                            - code
+                            - message
+                        description: The list of validation errors.
+                    required:
+                      - code
+                      - message
+                      - errors
+      tags:
+        - webhooks
     delete:
       operationId: WebhookEndpointsController_delete
       summary: Delete a Webhook Endpoint
@@ -16449,16 +16648,109 @@ components:
           description: The HTTPS URL where webhooks will be sent.
           example: https://example.com/webhooks
         events:
+          type: array
           description: The events that the Webhook Endpoint is subscribed to.
+          items:
+            type: string
+            enum: &ref_6
+              - authentication.email_verification_succeeded
+              - authentication.magic_auth_failed
+              - authentication.magic_auth_succeeded
+              - authentication.mfa_succeeded
+              - authentication.oauth_failed
+              - authentication.oauth_succeeded
+              - authentication.password_failed
+              - authentication.password_succeeded
+              - authentication.passkey_failed
+              - authentication.passkey_succeeded
+              - authentication.sso_failed
+              - authentication.sso_started
+              - authentication.sso_succeeded
+              - authentication.sso_timed_out
+              - authentication.radar_risk_detected
+              - api_key.created
+              - api_key.revoked
+              - connection.activated
+              - connection.deactivated
+              - connection.saml_certificate_renewal_required
+              - connection.saml_certificate_renewed
+              - connection.deleted
+              - dsync.activated
+              - dsync.deleted
+              - dsync.group.created
+              - dsync.group.deleted
+              - dsync.group.updated
+              - dsync.group.user_added
+              - dsync.group.user_removed
+              - dsync.user.created
+              - dsync.user.deleted
+              - dsync.user.updated
+              - email_verification.created
+              - flag.created
+              - flag.deleted
+              - flag.updated
+              - flag.rule_updated
+              - invitation.accepted
+              - invitation.created
+              - invitation.resent
+              - invitation.revoked
+              - magic_auth.created
+              - organization.created
+              - organization.deleted
+              - organization.updated
+              - organization_domain.created
+              - organization_domain.deleted
+              - organization_domain.updated
+              - organization_domain.verified
+              - organization_domain.verification_failed
+              - password_reset.created
+              - password_reset.succeeded
+              - user.created
+              - user.updated
+              - user.deleted
+              - organization_membership.created
+              - organization_membership.deleted
+              - organization_membership.updated
+              - role.created
+              - role.deleted
+              - role.updated
+              - organization_role.created
+              - organization_role.deleted
+              - organization_role.updated
+              - permission.created
+              - permission.deleted
+              - permission.updated
+              - session.created
+              - session.revoked
           example:
             - user.created
             - dsync.user.created
-          type: array
-          items:
-            type: string
       required:
         - endpoint_url
         - events
+    UpdateWebhookEndpointDto:
+      type: object
+      properties:
+        endpoint_url:
+          type: string
+          description: The HTTPS URL where webhooks will be sent.
+          example: https://example.com/webhooks
+        status:
+          type: string
+          enum:
+            - enabled
+            - disabled
+          description: Whether the Webhook Endpoint is enabled or disabled.
+          example: enabled
+        events:
+          type: array
+          description: The events that the Webhook Endpoint is subscribed to.
+          items:
+            type: string
+            enum: *ref_6
+          example:
+            - user.created
+            - dsync.user.created
     WidgetSessionTokenDto:
       type: object
       properties: